A 73-year-old widow by the name of Margaret thought she met a nice man on match.com. In fact her suitor was a hacker who stole $20,000 from us, and she laundered his money. You could be a victim, too.
Last April, I took a guided tour through the world of cyber-crime. I learned brand-new (to me) words like “phishing” and took a peek into the dark world of catfishing and romance scams. I was lucky—my education cost only $20,000. Others have gotten the same education but it cost them 10 times as much.
The cast of characters includes my husband, my adult daughter, a lovesick lady I don’t know who lives in the Chicago suburbs, and a South African scammer. And the cast includes me, of course, as well as a hapless realtor and the executives of a prominent Chicago realty firm.
She wasn’t talking with the real estate agent. She was chatting with a hacker who may have been in South Africa.
The story starts in midtown Chicago, where my daughter Emma lived in a tiny, crowded basement apartment with her significant other and young son, Damien. The little family needed a bigger place. When my husband’s father left us a substantial inheritance several years earlier, he stipulated that part was to help our children buy homes.
My excited daughter, Emma, started condo shopping. Working with a well-known Chicago realty firm, she found a nice, updated condominium with wood floors and a new kitchen, located on a tree-lined street near busy Lincoln Square on the city’s north side. Once she found the property, she communicated via email with the realtor, who I’ll call Sheila Kennedy.
The realty company, @properties, is the largest real estate brokerage firm in the state of Illinois and one of the top 12 residential brokers in the U.S. With more than 20 offices around the city, the company is respected and successful. We certainly didn’t expect any problems.
CHATTING WITH A HACKER: Emma frequently exchanged pleasantries with Sheila. We later learned, however, that she wasn’t talking with Sheila much of the time. She was chatting innocently with a hacker who may have been in South Africa, someone who had commandeered Sheila’s account against her will and without her knowledge. Maybe it was that 400-pound hacker working from his bedroom that then-presidential-candidate Donald Trump mentioned during the first presidential debate?
One imagines hackers as brilliant guys who know all about various programming languages and how to write code to exploit weaknesses in a network. They seek out open ports in a system, figure out a way to crack passwords (that’s why strong passwords are so important), give themselves administrative privileges, and create backdoors so they can get back into systems. Then they take over, wreaking havoc if they wish but usually just sneaking around gathering information and hiding their “footprints” as they go.
If that sounds complicated, it is. And that’s probably not how the hackers got access to Sheila’s email. They probably used a simple “phishing” scheme, meaning they sent her an innocent-looking email from someone she thought was a friend, asking her to click on a link or download a PDF. Somehow—I’m not knowledgeable enough to know how—communications from my daughter to Sheila were then diverted.
“The scheme was very sophisticated,” I heard over and over again from bank and police officers both at home in Alabama and in Chicago.
Sheila’s last real email was dated April 8. She asked that a check for $2,000 earnest money be mailed to Dream Town Realty. Her following e-mails—from the same gmail account, with all the same addresses and slogans at the bottom—came from the imposter. The new emails even boasted, “Top Agent Magazine, 2014 & 2015,” and “Chicago Top Producer 2009, 2010, 2012, 2013 & 2014.”
“I have a busy schedule today with closings and meeting, I will wait on your email,” says one. “I hope you are keeping safe from all the storms and tornadoes,” reads another, and “I hope you had a nice Easter,” says yet another.
The one thing all the emails had in common was continual reminders about the necessity of wiring the $20,000 down payment to the title company. The emails continued to be friendly, their tone casual.
“Sorry I was in a showing since 8am, just got your email, I am walking into another meeting till 4pm, Let me know once the wire has been done,” the hacker wrote, for example.
AN ARDENT SUITOR: In the meantime, a 73-year-old widow by the name of Margaret thought she had met a very nice man on match.com. A devout Catholic, she lived in the northwest Chicago suburb of Algonquin and had built a reputation as a talented artisan, arranging beautiful floral arrangements in collectibles such as vintage china or a tiny child’s wooden sled. Margaret’s Swiss-born husband, Walter, had died recently, so she was testing the waters after many years of marriage. She was the perfect prey for a romance scam—catfishing, it’s called.
Her suitor was a businessman building a hospital in China, and he needed emergency funds.
Romance scammers prey on nice people. They look for kind people, people with empathy. They build trust, setting their snares. When they need help, the nice lady or the nice man responds. Margaret is lucky she didn’t lose a lot of money; the criminal behind this particular elaborate scheme only wanted a legitimate bank account in the Chicago area where the marks—my husband and me—could wire money without our suspicions being aroused.
Margaret wasn’t suspicious, either. Her suitor was a businessman building a hospital in China. He had a need for emergency funds. When the money was wired into her account, she immediately sent it on to China. At least that’s where she thought the money went. Police later told me they traced our $20,000 to South Africa. Technically, Margaret was a money-launderer. Nobody thought of pressing charges, however.
We would have been on guard immediately if we had been instructed to wire money to a foreign account. In fact, we were on guard soon after, when “Sheila” asked us to wire another $60,000 as part of the purchase price. We knew that didn’t sound right because that money should have come from mortgage proceeds, and we hadn’t completed the process. We immediately started asking questions.
As soon as we confirmed that Sheila knew nothing about the $20,000, we contacted an @properties vice president I’ll call Wayne Kelly. He let slip that another couple turned up for a closing that same afternoon, thinking they wired $60,000 to a title company. As I researched the subject, I found this type of wire fraud is common in real-estate transactions. People have wired hundreds of thousands of dollars into bank accounts controlled by criminals.
AVOID BEING A VICTIM: What would I tell someone to do to avoid being a victim? Some states actually require that funds be transferred before closing via wire transfer—ironically, to avoid scams using fake cashier’s checks. When you get wire instructions for your closing, call your closing agent or your real estate attorney to verify those instructions. And use the phone number you’ve been using with them, not a new phone number emailed to you.
Also, absolutely refuse to communicate with your realtor or any other party to the transaction if he or she is using a free email server like gmail. Free email accounts are more vulnerable because they don’t have the firewalls, virus protection and other security of company-issued e-mail accounts. Any real estate company that hasn’t warned its agents is negligent—but the law is sketchy, so that can be hard to prove in court.
If you don’t want to be an inadvertent money launderer (or worse, get scammed yourself), be cautious on dating sites. Anyone can put up a fake photo of a debonair gent or beautiful young woman, and these scammers will spend hours drawing you out and listening to your dreams and schemes. If they profess their love too soon, be suspicious—especially if they’re in a foreign country and claim to have no family.
Some are more patient, though, and will spend months wooing you with intimate conversation. As soon as they ask for money, though, run the other direction.
I’ve tried to find Margaret to learn more about her experience. She’s no longer at her home in Algonquin, and her phone is disconnected. I tracked her down on Facebook and learned she’s moved into a retirement community. I tried sending her a message but got no reply. I’m sure she’s embarrassed, but I bear her no ill will. I just want to share the story so others will be careful.
I’ve had to tell the story to bank officials, our investment adviser (who took care of wiring the funds), and police officers in two states, as well as filing a report with the FBI and Equifax. The worst thing was enduring an interview with an embarrassed representative from a local senior services agency, who was tasked with determining whether I was in full possession of all my faculties.
As I talked to all these people, I learned that variations on wire fraud scams are shockingly common. One wealthy man in the small town where I live lost over $250,000. Fortunately he could afford to lose it, a police officer told me.
Most of us can’t, so be careful.
talking to myself 